1. Field of the Invention
The present invention relates to managing secure communications with software environments.
2. Description of Prior Art
Information services and data processing industries in general have rapidly expanded as a result of the need for computer systems to manage and store large amounts of data. As an example, financial service companies such as banks, mutual fund companies and the like now, more than ever before, require access to many hundreds of gigabytes or even terabytes of data and files stored in high capacity data storage systems. Other types of service companies have similar needs for data storage.
Data storage system developers have responded to the increased need for storage by integrating high capacity data storage systems, data communications devices (e.g., switches), and computer systems (e.g., host computers or servers) into so-called “storage networks” or “Storage Area Networks” (SANs.)
In general, a storage area network is a collection of data storage systems that are networked together via a switching fabric to a number of host computer systems operating as servers. The host computers access data stored in the data storage systems (of a respective storage area network) on behalf of client computers that request data from the data storage systems. For example, according to conventional applications, upon receiving a storage access request, a respective host computer in the storage area network accesses a large repository of storage through the switching fabric of the storage area network on behalf of the requesting client. Thus, via the host computer (e.g., server), a client has access to the shared storage system through the host computer. In many applications, storage area networks support hi-speed acquisitions of data so that the host servers are able to promptly retrieve and store data from the data storage system.
Conventional storage area network management applications typically include a graphical user interface (GUI) that enables a network manager to graphically manage, control, and configure various types of hardware and software resources associated with a corresponding managed storage area network. For example, one conventional storage management application generates a graphical user interface utilized by a storage administrator to graphically select, interact with, and manage local or remote devices and software processes associated with the storage area network. Based on use of the graphical user interface in combination with an input device such as a hand operated mouse and corresponding pointer displayed on a viewing screen or other display, a storage administrator is able to manage hardware and software entities such as file systems, databases, storage devices, volumes, peripherals, network data communications devices, etc., associated with the storage area network. Consequently, a storage management station and associated management software enables a storage administrator (a person responsible for managing the storage network) to manage the storage area network and its resources.
A typical computer network being used today that can run object oriented software is a client-server network, the client being the user (GUI) or workstation and the server being software (discrete or distributed throughout the network) which serves the client. In this network, a computer system can employ one or more object-oriented computer languages such as C++, XML (eXtensible Markup Language), Java, Flash, and/or others. Briefly, an object, in computer software terms, is a dedicated area of memory which can be thought of as an impervious container holding both data and instructions within itself, both defining itself and its relationships to other objects in the computer system or network. Such object or node can send and receive messages to and from other objects, respond and react to such messages (e.g. commands) but shall normally be impervious to internal scrutiny. For example, in a computer data storage system (a kind of computer) each object (system object) may describe or relate to a specific tangible detail in the storage system or in the storage system's processor (e.g., details such as those describing or relating to aspects of operation of the processor's cooling-fan, power switch, cache memory, power supply, disk drive interface, individual disks, etc.).
With respect to networks, people today use the World Wide Web for a variety of different and diverse tasks for example locating information, ordering and buying goods on-line and managing their finances. Many users expect that these applications will operate regardless of what type of computer platform is used.
Java technology, which is a trademark of Sun Microsystems, Inc, helps provide a solution by allowing the creation of computer platform independent programs. The Java technology includes an object oriented programming language and a platform on which to run the Java applications (known as Java Runtime Environment or JRE). Java is both a compiled and an interpreted language. The source code that has been written by the application developer is compiled into an intermediate form called a Java bytecode, which is a platform independent language. At a client machine, the java bytecodes are interpreted by the Java platform and the Java interpreter parses and runs each Java bytecode instruction on the computer. (If the Java bytecode is run as a applet, it may first be sent over the network to the client machine.)
Java's objected oriented programming language is based on using objects and classes and this paragraph will introduce the reader to a few basic concepts. Just like real world objects, software objects consist of a state and a behavior. A software object maintains its state in one or more variables and a variable is an item of data named by an identifier. A software object implements its behavior with methods and a method is a function associated with an object. Just like any other objected oriented programming language objects communicate with each other by passing messages. Further object oriented concepts are well known in the art and will not be described here further.
The Java platform includes the Application Programming Interface (API), which is a large collection of ready-made software components, which provide a variety of capabilities, and the Java Virtual Machine (JVM) which will be explained in the paragraph below. Together the JVM and the API sit on top of the hardware based computer platform and provide a layer of abstraction between the Java program and the underlying hardware.
The JVM is made up of software, which can run a Java program on a specific computer platform of a client machine. Before a Java program can be run on a JVM, the Java program must first be translated into a format that the JVM recognizes, which is called a Java class file format. The Java class file format contains all the information needed by a Java runtime system to define a single Java class.
Adobe Flex is a collection of technologies released by Adobe Systems for the development and deployment of cross platform rich Internet applications based on the Adobe Flash platform. Flex provides a workflow and programming model that is familiar to developers. Macromedia XML (“MXML”), an eXtensible Markup Language (“XML”)-based markup language, offers a way to build and lay out graphic user interfaces. Interactivity is achieved through the use of ActionScript, the core language of Flash Player that is based on the European Computer Manufacturers Association (“ECMA”) ECMAScript standard. A Flex software development kit (“SDK”) comes with a set of user interface components including buttons, list boxes, trees, data grids, several text controls, charts, graphs and various layout containers. Other features such as web services, drag and drop, modal dialogs, animation effects, application states, form validation, and other interactions round out the application framework.
A Flex application may be a rich internet application (“RIA”). RIAs introduce an intermediate layer of code, often called a client engine, between the user and the server. This client engine is typically downloaded as part of the instantiation of the application, and may be supplemented by further code downloads as use of the application progresses. The client engine acts as an extension of the browser, and usually takes over responsibility for rendering the application's user interface and for server communication. What can be done in a RIA may be limited by the capabilities of the system used on the client, but in general, the client engine is programmed to perform application functions that its designer believes will enhance some aspect of the user interface, or improve its responsiveness when handling certain user interactions, compared to a standard Web browser implementation. Also, while simply adding a client engine does not force an application to depart from the normal synchronous pattern of interactions between browser and server, in most RIAs the client engine performs additional asynchronous communications with servers.
In a multi-tiered model, Flex applications serve as the presentation tier. Unlike page-based Hypertext Markup Language (“HTML”) applications, Flex applications provide a stateful client where significant changes to the view don't require loading a new page. Similarly, Flex and Flash Player provide many useful ways to send and load data to and from server-side components without requiring the client to reload the view. To incorporate a Flex application into a website, one typically embeds Shockwave Flash (.SWF) file in an HTML, JavaServer Pages (“JSP”), Adobe, ColdFusion, or other type of web page. The page that embeds the SWF file is known as the wrapper. A wrapper consists of an <object> tag and an <embed> tag that format the SWF file on the page, define data object locations, and pass run-time variables to the SWF file. In addition, the wrapper can include support for history management and Flash Player version detection and deployment.
It is possible for a Flex application to be launched from one domain and then connect back to a different domain by installing a cross domain policy file in a site.
The uses for the Internet and the World Wide Web are continually increasing, and have expanded into “secure” areas. Different mechanisms for maintaining security in a network such as the Internet have been developed, such as the Secure Sockets Layer (SSL) security protocol. The SSL protocol uses a public key infrastructure to maintain security. In establishing an SSL connection between a client computer and a server computer hosting a web page, the server computer transmits a certificate to the client computer for verification or validation.
A client/server network system and environment typically includes multiple network server computers, and multiple network client computers. The computers communicate with each other over a data communications network which may comprises a public network such as the Internet and/or local-area networks and private wide-area networks.
Each network server computer hosts content (e.g., Java or Flex applications and/or one or more World Wide Web pages) that can be accessed by a web browser or other application executing at a client computer. The web browser can establish a secure connection with one of the server computers using a secure communications protocol such as SSL.
Each client computer maintains a certificate store that includes one or more trusted certificates. The store can be implemented, for example, as part of the web browser or part of an operating system or some other application executing on the client. To establish a secure connection between a client computer and a server computer, the server computer transmits a server certificate to the client computer. The client computer uses the server certificate to verify or validate that server computer can be trusted.
The store is part of a software application (e.g., the web browser or an operating system). Certificates can be automatically added to the store after the application has been deployed and installed on client computers.
Each certificate may optionally include one or more usage parameters. These usage parameters are used to limit the manner in which the certificate can be used. For example, a particular certificate may have its usage limited to only certain applications. Thus, it may not be possible to use that particular certificate for establishing a secure connection to a server computer. In an example, the usage parameters are denoted by properties, policy extensions, and/or an enhance key usage (EKU) extension that are part of, or alternatively associated with, the certificate.
The SSL protocol (sometimes called the Transport Level Security (TLS) protocol) is an industry standard method by which secure data connections or sessions can be established. The SSL protocol provides data encryption, server authentication, message integrity and optional client authentication over computer networks. SSL is a so-called transport layer protocol since it is defined to operate on the “sockets” level of a computer network. It will be understood by those skilled in the art that “sockets” is the standard application program interface (API) by which data is transferred on the transport level of a computer network. As a result of SSL operating on the sockets level of a network, there must be an end-to-end direct connection between networked devices in order for SSL to function correctly.
Java offers storage for public and private keys, and their associated certificates or certificate chains in a database known as a Keystore. The default Keystore implementation in Java is a flat file in a proprietary form known as a Java Keystore, or JKS.
Many commercial software applications require security functionality beyond that provided by the Java platform. RSA BSAFE® security tools for Java developers provides a set of common libraries written in Java for meeting security requirements of commercial software applications. RSA BSAFE® software helps Java application developers meet these requirements. The software also extends the core security capabilities of the Java platform by meeting requirements of series 140 of Federal Information Processing Standards (FIPS 140), which is the U.S. government standard which specifies the security requirements to be satisfied by a cryptographic module to be used by a Federal agency. The current version of the standard is FIPS 140-2.
Typically in practice, when a user's Web browser first tries to contact a server for a secure transaction, the server sends its digital certificate to the browser. This certificate includes (among other things) the server's public key, the server's identity, the name of the certificate authority (CA) that signed the certificate and the signature itself (which is a mathematical hash of the certificate encrypted with the CA's private key). To validate the certificate, the browser computes the certificate hash and compares the result with the hash obtained by decrypting the signature using the CA's public key (as well as checking the validity dates and identity included in the certificate against the desired server). To then validate the server, the browser encrypts a message with the public key obtained from the certificate and sends it to the server. If the server can prove it can decrypt that message then it must have the associated private key and the authentication has succeeded. If desired, the server may likewise validate the browser. Once the browser and (optionally) the server is/are satisfied that each is the computer it claims to be, the browser and server can exchange session keys (additional keys that are used to encrypt the data transfers between the computers from then on).